/*
 * Wazuh databaseFeedManager
 * Copyright (C) 2015, Wazuh Inc.
 * October 9, 2023.
 *
 * This program is free software; you can redistribute it
 * and/or modify it under the terms of the GNU General Public
 * License (version 2) as published by the FSF - Free Software
 * Foundation.
 */

#include "updateCVECandidates_test.hpp"
#include "flatbuffers/idl.h"
#include "flatbuffers/verifier.h"
#include "rocksDBWrapper.hpp"
#include "updateCVECandidates.hpp"

namespace NSUpdateCVECandidatesTest
{
    const char* INCLUDE_DIRECTORIES[] = {FLATBUFFER_SCHEMAS_DIR, nullptr};

    const std::string CVE5_FLATBUFFER_SCHEMA_PATH {FLATBUFFER_SCHEMAS_DIR "/cve5.fbs"};
    const std::string VULNERABILITY_CANDIDATE_FLATBUFFER_SCHEMA_PATH {FLATBUFFER_SCHEMAS_DIR
                                                                      "/vulnerabilityCandidate.fbs"};

    const std::string CVE_ID = "CVE-2010-0002";

    const std::string CVE_INPUT = R"(
        {
            "containers": {
                "adp": [
                    {
                        "affected": [
                            {
                                "defaultStatus": "unknown",
                                "product": "bash",
                                "vendor" : "canonical",
                                "platforms": [
                                    "upstream"
                                ],
                                "versions": [
                                    {
                                        "lessThan": "98.0.4758.102",
                                        "status": "affected",
                                        "version": "0",
                                        "versionType": "custom"
                                    }
                                ]
                            },
                            {
                                "defaultStatus": "unaffected",
                                "product": "bash",
                                "vendor" : "canonical",
                                "platforms": [
                                    "dapper",
                                    "hardy",
                                    "intrepid",
                                    "jaunty",
                                    "karmic",
                                    "lucid"
                                ]
                            }
                        ],
                        "descriptions": [
                            {
                                "lang": "en",
                                "value": "The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash\n2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in\nLS_OPTIONS, which allows local users to send escape sequences to terminal\nemulators, or hide the existence of a file, via a crafted filename."
                            },
                            {
                                "lang": "en",
                                "value": "Mandriva-specific"
                            }
                        ],
                        "providerMetadata": {
                            "orgId": "00000000-0000-4000-A000-000000000000",
                            "shortName" : "canonical",
                            "x_subShortName": "canonical"
                        },
                        "references": [
                            {
                                "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0002"
                            }
                        ]
                    },
                    {
                        "affected": [
                            {
                                "defaultStatus": "unaffected",
                                "platforms": [
                                    "bookworm",
                                    "bullseye",
                                    "buster",
                                    "sid",
                                    "trixie"
                                ],
                                "product": "bash",
                                "vendor": "debian"
                            }
                        ],
                        "descriptions": [
                            {
                                "lang": "en",
                                "value": "The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LS_OPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename."
                            }
                        ],
                        "providerMetadata": {
                            "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
                            "shortName" : "debian",
                            "x_subShortName": "debian"
                        },
                        "references": [
                            {
                                "url": "https://security-tracker.debian.org/tracker/CVE-2010-0002"
                            }
                        ]
                    }
                ],
                "cna": {
                    "affected": [
                        {
                            "cpes": [
                                "cpe:2.3:a:gnu:bash:3.2.48:*:*:*:*:*:*:*",
                                "cpe:2.3:a:gnu:bash:3.0:*:*:*:*:*:*:*",
                                "cpe:2.3:a:gnu:bash:4.0:*:*:*:*:*:*:*",
                                "cpe:2.3:a:gnu:bash:3.2:*:*:*:*:*:*:*"
                            ],
                            "defaultStatus": "unaffected",
                            "product": "bash",
                            "vendor": "gnu",
                            "versions": [
                                {
                                    "status": "affected",
                                    "version": "3.2.48"
                                },
                                {
                                    "status": "affected",
                                    "version": "3.0"
                                },
                                {
                                    "status": "affected",
                                    "version": "4.0"
                                },
                                {
                                    "status": "affected",
                                    "version": "3.2"
                                }
                            ]
                        }
                    ],
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LS_OPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename."
                        }
                    ],
                    "metrics": [
                        {
                            "cvssV2_0": {
                                "accessComplexity": "LOW",
                                "accessVector": "LOCAL",
                                "authentication": "NONE",
                                "availabilityImpact": "PARTIAL",
                                "baseScore": 2.1,
                                "confidentialityImpact": "NONE",
                                "integrityImpact": "NONE",
                                "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                                "version": "2.0"
                            },
                            "format": "CVSS"
                        }
                    ],
                    "problemTypes": [
                        {
                            "descriptions": [
                                {
                                    "description": "CWE-20",
                                    "lang": "en"
                                }
                            ]
                        }
                    ],
                    "providerMetadata": {
                        "orgId": "00000000-0000-4000-A000-000000000001",
                        "shortName": "nvd",
                        "x_subShortName": "nvd"
                    },
                    "references": [
                        {
                            "name": "https://qa.mandriva.com/show_bug.cgi?id=56882",
                            "url": "https://qa.mandriva.com/show_bug.cgi?id=56882"
                        },
                        {
                            "name": "MDVSA-2010:004",
                            "tags": [
                                "patch",
                                "vendor-advisory"
                            ],
                            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:004"
                        }
                    ]
                }
            },
            "cveMetadata": {
                "assignerOrgId": "00000000-0000-4000-A000-000000000000",
                "assignerShortName": "@redhat.com",
                "cveId": "CVE-2010-0002",
                "datePublished": "2010-01-14T18:30:00.000Z",
                "dateUpdated": "2011-08-08T04:00:00.000Z",
                "state": "PUBLISHED"
            },
            "dataType": "CVE_RECORD",
            "dataVersion": "5.0"
        }
    )";

    const std::string CVE_INPUT_2 = R"(
    {
    "containers": {
        "adp": [
            {
                "affected": [
                    {
                        "defaultStatus": "unknown",
                        "product": "bash",
                        "vendor" : "canonical",
                        "platforms": [
                            "upstream"
                        ],
                        "versions": [
                            {
                                "lessThan": "98.0.4758.102",
                                "status": "affected",
                                "version": "0",
                                "versionType": "custom"
                            }
                        ]
                    },
                    {
                        "defaultStatus": "unaffected",
                        "product": "kernel",
                        "vendor" : "canonical",
                        "platforms": [
                            "dapper",
                            "hardy",
                            "intrepid",
                            "jaunty",
                            "karmic",
                            "lucid"
                        ]
                    }
                ],
                "descriptions": [
                    {
                        "lang": "en",
                        "value": "The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash\n2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in\nLS_OPTIONS, which allows local users to send escape sequences to terminal\nemulators, or hide the existence of a file, via a crafted filename."
                    },
                    {
                        "lang": "en",
                        "value": "Mandriva-specific"
                    }
                ],
                "providerMetadata": {
                    "orgId": "00000000-0000-4000-A000-000000000000",
                    "shortName" : "canonical",
                    "x_subShortName": "canonical"
                },
                "references": [
                    {
                        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0002"
                    }
                ]
            },
            {
                "affected": [
                    {
                        "defaultStatus": "unaffected",
                        "platforms": [
                            "bookworm",
                            "bullseye",
                            "buster",
                            "sid",
                            "trixie"
                        ],
                        "product": "bash",
                        "vendor": "debian"
                    },
                    {
                        "defaultStatus": "unaffected",
                        "platforms": [
                            "bookworm",
                            "bullseye",
                            "buster",
                            "sid",
                            "trixie"
                        ],
                        "product": "firefox",
                        "vendor": "debian"
                    }
                ],
                "descriptions": [
                    {
                        "lang": "en",
                        "value": "The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LS_OPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename."
                    }
                ],
                "providerMetadata": {
                    "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
                    "shortName" : "debian",
                    "x_subShortName": "debian"
                },
                "references": [
                    {
                        "url": "https://security-tracker.debian.org/tracker/CVE-2010-0002"
                    }
                ]
            }
        ],
        "cna": {
            "affected": [
                {
                    "cpes": [
                        "cpe:2.3:a:gnu:bash:3.2.48:*:*:*:*:*:*:*",
                        "cpe:2.3:a:gnu:bash:3.0:*:*:*:*:*:*:*",
                        "cpe:2.3:a:gnu:bash:4.0:*:*:*:*:*:*:*",
                        "cpe:2.3:a:gnu:bash:3.2:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "product": "bash",
                    "vendor": "gnu",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "3.2.48"
                        },
                        {
                            "status": "affected",
                            "version": "3.0"
                        },
                        {
                            "status": "affected",
                            "version": "4.0"
                        },
                        {
                            "status": "affected",
                            "version": "3.2"
                        }
                    ]
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LS_OPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename."
                }
            ],
            "metrics": [
                {
                    "cvssV2_0": {
                        "accessComplexity": "LOW",
                        "accessVector": "LOCAL",
                        "authentication": "NONE",
                        "availabilityImpact": "PARTIAL",
                        "baseScore": 2.1,
                        "confidentialityImpact": "NONE",
                        "integrityImpact": "NONE",
                        "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                        "version": "2.0"
                    },
                    "format": "CVSS"
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "description": "CWE-20",
                            "lang": "en"
                        }
                    ]
                }
            ],
            "providerMetadata": {
                "orgId": "00000000-0000-4000-A000-000000000001",
                "shortName": "nvd",
                "x_subShortName": "nvd"
            }
        }
    },
    "cveMetadata": {
        "assignerOrgId": "00000000-0000-4000-A000-000000000000",
        "assignerShortName": "@redhat.com",
        "cveId": "CVE-2020-0002",
        "datePublished": "2010-01-14T18:30:00.000Z",
        "dateUpdated": "2011-08-08T04:00:00.000Z",
        "state": "PUBLISHED"
    },
    "dataType": "CVE_RECORD",
    "dataVersion": "5.0"
}
)";

    const std::string CVE_INPUT_3 = R"(
    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "affected",
          "product": "windows_10",
          "vendor": "microsoft"
        },
        {
          "cpes": [
            "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*",
            "cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*",
            "cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*",
            "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*",
            "cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*",
            "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*",
            "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "windows_10",
          "vendor": "microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "1607"
            },
            {
              "status": "affected",
              "version": "1709"
            },
            {
              "status": "affected",
              "version": "1803"
            },
            {
              "status": "affected",
              "version": "1809"
            },
            {
              "status": "affected",
              "version": "1903"
            },
            {
              "status": "affected",
              "version": "1909"
            },
            {
              "status": "affected",
              "version": "2004"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "affected",
          "product": "windows_server_2016",
          "vendor": "microsoft"
        },
        {
          "cpes": [
            "cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*",
            "cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*",
            "cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "windows_server_2016",
          "vendor": "microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "1903"
            },
            {
              "status": "affected",
              "version": "1909"
            },
            {
              "status": "affected",
              "version": "2004"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "affected",
          "product": "windows_server_2019",
          "vendor": "microsoft"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An elevation of privilege vulnerability exists when the Windows USO Core Worker improperly handles memory.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows USO Core Worker Elevation of Privilege Vulnerability'."
        },
        {
          "lang": "es",
          "value": "Se presenta una vulnerabilidad de elevación de privilegios cuando el Windows USO Core Worker maneja inapropiadamente la memoria. Para explotar esta vulnerabilidad, un atacante primero tendría que conseguir una ejecución en el sistema víctima, también se conoce como \"Windows USO Core Worker Elevation of Privilege Vulnerability\""
        }
      ],
      "metrics": [
        {
          "cvssV2_0": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.6,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "NVD-CWE-noinfo",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-07-21T11:39:23Z",
        "orgId": "00000000-0000-4000-A000-000000000003",
        "shortName": "nvd",
        "x_subShortName": "nvd"
      },
      "references": [
        {
          "tags": [
            "patch",
            "vendor-advisory"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1352"
        }
      ],
      "x_remediations": {
        "windows": [
          {
            "anyOf": [
              "KB4558998",
              "KB4559003",
              "KB4565349",
              "KB4570333",
              "KB4571748",
              "KB4577069",
              "KB4577668",
              "KB4580390",
              "KB4586793",
              "KB4586839",
              "KB4592440",
              "KB4594442",
              "KB4598230",
              "KB4598296",
              "KB4601345",
              "KB4601383",
              "KB5000822",
              "KB5000854",
              "KB5001342",
              "KB5001384",
              "KB5001568",
              "KB5001638",
              "KB5003171",
              "KB5003217",
              "KB5003646",
              "KB5003703",
              "KB5004244",
              "KB5004308",
              "KB5004947",
              "KB5005030",
              "KB5005102",
              "KB5005394",
              "KB5005568",
              "KB5005625",
              "KB5006672",
              "KB5006744",
              "KB5007206",
              "KB5007266",
              "KB5008218",
              "KB5008602",
              "KB5009557",
              "KB5009616",
              "KB5010196",
              "KB5010351",
              "KB5010427",
              "KB5010791",
              "KB5011503",
              "KB5011551",
              "KB5012636",
              "KB5012647",
              "KB5013941",
              "KB5014022",
              "KB5014669",
              "KB5014692",
              "KB5015018",
              "KB5015811",
              "KB5015880",
              "KB5016623",
              "KB5016690",
              "KB5017315",
              "KB5017379",
              "KB5018419",
              "KB5019966",
              "KB5020438",
              "KB5021237",
              "KB5021655",
              "KB5022286",
              "KB5022554",
              "KB5022840",
              "KB5023702",
              "KB5025229",
              "KB5026362",
              "KB5027222",
              "KB5028168",
              "KB5029247",
              "KB5030214",
              "KB5031361",
              "KB5032196",
              "KB5033371",
              "KB5034127",
              "KB5034768"
            ],
            "products": [
              "Windows 10 Version 1809 for 32-bit Systems",
              "Windows 10 Version 1809 for ARM64-based Systems",
              "Windows 10 Version 1809 for x64-based Systems",
              "Windows Server 2019",
              "Windows Server 2019 Server Core installation"
            ],
            "type": "update"
          },
          {
            "anyOf": [
              "KB4559004",
              "KB4565351",
              "KB4565483",
              "KB4566116",
              "KB4574727",
              "KB4577062",
              "KB4577671",
              "KB4580386",
              "KB4586786",
              "KB4586819",
              "KB4592449",
              "KB4594443",
              "KB4598229",
              "KB4598298",
              "KB4601315",
              "KB4601380",
              "KB5000808",
              "KB5000850",
              "KB5001028",
              "KB5001337",
              "KB5001396",
              "KB5001566",
              "KB5001648",
              "KB5003169",
              "KB5003212",
              "KB5003635",
              "KB5003698",
              "KB5004245",
              "KB5004293",
              "KB5004946",
              "KB5005031",
              "KB5005103",
              "KB5005566",
              "KB5005624",
              "KB5006667",
              "KB5007189",
              "KB5008206",
              "KB5009545",
              "KB5010345",
              "KB5010792",
              "KB5011485",
              "KB5012591",
              "KB5013945",
              "KB5014701"
            ],
            "products": [
              "Windows 10 Version 1903 for 32-bit Systems",
              "Windows 10 Version 1903 for ARM64-based Systems",
              "Windows 10 Version 1903 for x64-based Systems",
              "Windows 10 Version 1909 for 32-bit Systems",
              "Windows 10 Version 1909 for ARM64-based Systems",
              "Windows 10 Version 1909 for x64-based Systems",
              "Windows Server, version 1903 Server Core installation",
              "Windows Server, version 1909 Server Core installation"
            ],
            "type": "update"
          },
          {
            "anyOf": [
              "KB4565489",
              "KB4571709",
              "KB4577032",
              "KB4580330",
              "KB4586785",
              "KB4592446",
              "KB4598245",
              "KB4601354",
              "KB5000809",
              "KB5001339",
              "KB5001565",
              "KB5001634",
              "KB5003174"
            ],
            "products": [
              "Windows 10 Version 1803 for 32-bit Systems",
              "Windows 10 Version 1803 for ARM64-based Systems",
              "Windows 10 Version 1803 for x64-based Systems"
            ],
            "type": "update"
          },
          {
            "anyOf": [
              "KB4565503",
              "KB4566782",
              "KB4568831",
              "KB4571744",
              "KB4571756",
              "KB4577063",
              "KB4579311",
              "KB4580364",
              "KB4586781",
              "KB4586853",
              "KB4592438",
              "KB4594440",
              "KB4598242",
              "KB4598291",
              "KB4601319",
              "KB4601382",
              "KB5000802",
              "KB5000842",
              "KB5001330",
              "KB5001391",
              "KB5001567",
              "KB5001649",
              "KB5003173",
              "KB5003214",
              "KB5003637",
              "KB5003690",
              "KB5004237",
              "KB5004245",
              "KB5004293",
              "KB5004296",
              "KB5004476",
              "KB5004760",
              "KB5004945",
              "KB5004946",
              "KB5005031",
              "KB5005033",
              "KB5005101",
              "KB5005103",
              "KB5005565",
              "KB5005566",
              "KB5005611",
              "KB5005624",
              "KB5006667",
              "KB5006670",
              "KB5006738",
              "KB5007186",
              "KB5007189",
              "KB5007253",
              "KB5008206",
              "KB5008212",
              "KB5009543",
              "KB5009545",
              "KB5009596",
              "KB5010342",
              "KB5010345",
              "KB5010415",
              "KB5010792",
              "KB5010793",
              "KB5011485",
              "KB5011487",
              "KB5011543",
              "KB5011831",
              "KB5012591",
              "KB5012599",
              "KB5013942",
              "KB5013945",
              "KB5014023",
              "KB5014666",
              "KB5014699",
              "KB5014701",
              "KB5015020",
              "KB5015807",
              "KB5015878",
              "KB5016139",
              "KB5016616",
              "KB5016688",
              "KB5017308",
              "KB5017380",
              "KB5018410",
              "KB5018482",
              "KB5019275",
              "KB5019959",
              "KB5020030",
              "KB5020435",
              "KB5020953",
              "KB5021233",
              "KB5022282",
              "KB5022834",
              "KB5022906",
              "KB5023696",
              "KB5023773",
              "KB5025221",
              "KB5025297",
              "KB5026361",
              "KB5026435",
              "KB5027215",
              "KB5027293",
              "KB5028166",
              "KB5028244",
              "KB5029244",
              "KB5029331",
              "KB5030211",
              "KB5030300",
              "KB5031356",
              "KB5031445",
              "KB5032189",
              "KB5032278",
              "KB5033372",
              "KB5034122",
              "KB5034203",
              "KB5034763"
            ],
            "products": [
              "Windows 10 Version 2004 for 32-bit Systems",
              "Windows 10 Version 2004 for ARM64-based Systems",
              "Windows 10 Version 2004 for x64-based Systems",
              "Windows Server, version 2004 Server Core installation"
            ],
            "type": "update"
          },
          {
            "anyOf": [
              "KB4565508",
              "KB4571741",
              "KB4577041",
              "KB4580328"
            ],
            "products": [
              "Windows 10 Version 1709 for 32-bit Systems",
              "Windows 10 Version 1709 for ARM64-based Systems",
              "Windows 10 Version 1709 for x64-based Systems"
            ],
            "type": "update"
          },
          {
            "anyOf": [
              "KB4565511",
              "KB4571694",
              "KB4577015",
              "KB4580346",
              "KB4586830",
              "KB4593226",
              "KB4594441",
              "KB4598243",
              "KB4601318",
              "KB5000803",
              "KB5001347",
              "KB5001633",
              "KB5003197",
              "KB5003638",
              "KB5004238",
              "KB5004249",
              "KB5004948",
              "KB5004950",
              "KB5005040",
              "KB5005043",
              "KB5005393",
              "KB5005569",
              "KB5005573",
              "KB5006669",
              "KB5006675",
              "KB5007192",
              "KB5007207",
              "KB5008207",
              "KB5008230",
              "KB5008601",
              "KB5009546",
              "KB5009585",
              "KB5010195",
              "KB5010358",
              "KB5010359",
              "KB5010789",
              "KB5010790",
              "KB5011491",
              "KB5011495",
              "KB5012596",
              "KB5012653",
              "KB5013952",
              "KB5013963",
              "KB5014702",
              "KB5014710",
              "KB5015019",
              "KB5015808",
              "KB5015832",
              "KB5016622",
              "KB5016639",
              "KB5017305",
              "KB5017327",
              "KB5018411",
              "KB5018425",
              "KB5019964",
              "KB5019970",
              "KB5020439",
              "KB5020440",
              "KB5021235",
              "KB5021243",
              "KB5021654",
              "KB5022289",
              "KB5022297",
              "KB5022838",
              "KB5022858",
              "KB5023697",
              "KB5023713",
              "KB5025228",
              "KB5025234",
              "KB5026363",
              "KB5026382",
              "KB5027219",
              "KB5027230",
              "KB5028169",
              "KB5028186",
              "KB5028622",
              "KB5028623",
              "KB5029242",
              "KB5029259",
              "KB5030213",
              "KB5030220",
              "KB5031362",
              "KB5031377",
              "KB5032197",
              "KB5032199",
              "KB5033373",
              "KB5033379",
              "KB5034119",
              "KB5034134",
              "KB5034767",
              "KB5034774"
            ],
            "products": [
              "Windows 10 Version 1607 for 32-bit Systems",
              "Windows 10 Version 1607 for x64-based Systems",
              "Windows Server 2016",
              "Windows Server 2016 Server Core installation"
            ],
            "type": "update"
          },
          {
            "anyOf": [
              "KB4565513",
              "KB4571692",
              "KB4577049",
              "KB4580327",
              "KB4586787",
              "KB4592464",
              "KB4598231",
              "KB4601331",
              "KB5000807",
              "KB5001340",
              "KB5001631",
              "KB5003172",
              "KB5003687",
              "KB5004249",
              "KB5004950",
              "KB5005040",
              "KB5005569",
              "KB5006675",
              "KB5007207",
              "KB5008230",
              "KB5009585",
              "KB5010358",
              "KB5010789",
              "KB5011491",
              "KB5012653",
              "KB5013963",
              "KB5014710",
              "KB5015832",
              "KB5016639",
              "KB5017327",
              "KB5018425",
              "KB5019970",
              "KB5020440",
              "KB5021243",
              "KB5022297",
              "KB5022858",
              "KB5023713",
              "KB5025234",
              "KB5026382",
              "KB5027230",
              "KB5028186",
              "KB5028622",
              "KB5029259",
              "KB5030220",
              "KB5031377",
              "KB5032199",
              "KB5033379",
              "KB5034134",
              "KB5034774"
            ],
            "products": [
              "Windows 10 for 32-bit Systems",
              "Windows 10 for x64-based Systems"
            ],
            "type": "update"
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2020-1352",
    "datePublished": "2020-07-14T23:15:13Z",
    "dateUpdated": "2021-07-21T11:39:23Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.0"
})";

    const std::string CVE_INPUT_4 = R"(
    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:pixar:openusd:20.05:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "openusd",
          "vendor": "pixar",
          "versions": [
            {
              "status": "affected",
              "version": "20.05"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "macos",
          "vendor": "apple",
          "versions": [
            {
              "lessThan": "11.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An out of bounds memory corruption vulnerability exists in the way Pixar OpenUSD 20.05 reconstructs paths from binary USD files. A specially crafted malformed file can trigger an out of bounds memory modification which can result in remote code execution. To trigger this vulnerability, victim needs to access an attacker-provided malformed file."
        },
        {
          "lang": "es",
          "value": "Se presenta una vulnerabilidad de corrupción de memoria fuera de límites en la forma en que Pixar OpenUSD versión 20.05, reconstruye rutas a partir de archivos USD binarios.&#xa0;Un archivo malformado especialmente diseñado puede desencadenar una modificación de la memoria fuera de límites que puede resultar en una ejecución de código remota.&#xa0;Para desencadenar esta vulnerabilidad, la víctima debe acceder a un archivo malformado proporcionado por el atacante"
        }
      ],
      "metrics": [
        {
          "cvssV2_0": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "CWE-119",
              "lang": "en"
            },
            {
              "cweId": "CWE-787",
              "description": "CWE-787",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-07T18:36:52Z",
        "orgId": "00000000-0000-4000-A000-000000000003",
        "shortName": "nvd",
        "x_subShortName": "nvd"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "technical-description",
            "third-party-advisory"
          ],
          "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1120"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://support.apple.com/kb/HT212011"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2020-13520",
    "datePublished": "2020-12-11T04:15:11Z",
    "dateUpdated": "2022-06-07T18:36:52Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.0"
})";

} // namespace NSUpdateCVECandidatesTest

using namespace NSUpdateCVECandidatesTest;

TEST_F(UpdateCVECandidatesTest, UpdateCVECandidateSuccess)
{
    std::string cve5FlatbufferSchemaStr;

    // Read schemas from filesystem.
    bool valid = flatbuffers::LoadFile(CVE5_FLATBUFFER_SCHEMA_PATH.c_str(), false, &cve5FlatbufferSchemaStr);
    ASSERT_EQ(valid, true);

    // Parse schemas and JSON example.
    flatbuffers::Parser parser;
    valid = (parser.Parse(cve5FlatbufferSchemaStr.c_str(), INCLUDE_DIRECTORIES) && parser.Parse(CVE_INPUT.c_str()));
    ASSERT_EQ(valid, true);

    // Get flatbuffer pointer
    uint8_t const* buf = parser.builder_.GetBufferPointer();
    size_t flatbufferSize = parser.builder_.GetSize();

    // Verify flatbuffer.
    flatbuffers::Verifier verifierCVE5(buf, flatbufferSize);
    ASSERT_EQ(cve_v5::VerifyEntryBuffer(verifierCVE5), true);
    const cve_v5::Entry* cve5Flatbuffer = cve_v5::GetEntry(buf);

    // Call function.
    UpdateCVECandidates::storeVulnerabilityCandidate(cve5Flatbuffer, m_feedDatabase.get());

    // Verify Debian data
    rocksdb::PinnableSlice slice;
    EXPECT_NO_THROW(m_feedDatabase->get("bash_CVE-2010-0002", slice, "debian"));

    flatbuffers::Verifier verifierVulnCandidate(reinterpret_cast<const uint8_t*>(slice.data()), slice.size());
    EXPECT_EQ(NSVulnerabilityScanner::VerifyScanVulnerabilityCandidateArrayBuffer(verifierVulnCandidate), true);

    auto data = NSVulnerabilityScanner::GetScanVulnerabilityCandidateArray(slice.data());
    EXPECT_EQ(data->candidates()->size(), 1);
    auto debianData = data->candidates()->Get(0);

    // Verify Debian values
    EXPECT_EQ(debianData->cveId()->str(), CVE_ID);
    EXPECT_EQ(debianData->defaultStatus(), NSVulnerabilityScanner::Status::Status_unaffected);
    EXPECT_EQ(debianData->platforms()->size(), 5);
    EXPECT_EQ(debianData->platforms()->Get(0)->str(), "bookworm");
    EXPECT_EQ(debianData->platforms()->Get(1)->str(), "bullseye");
    EXPECT_EQ(debianData->platforms()->Get(2)->str(), "buster");
    EXPECT_EQ(debianData->platforms()->Get(3)->str(), "sid");
    EXPECT_EQ(debianData->platforms()->Get(4)->str(), "trixie");
    EXPECT_EQ(debianData->versions()->size(), 0);

    // Verify NVD data
    EXPECT_NO_THROW(m_feedDatabase->get("bash_CVE-2010-0002", slice, "nvd"));

    flatbuffers::Verifier verifierVulnCandidate2(reinterpret_cast<const uint8_t*>(slice.data()), slice.size());
    EXPECT_EQ(NSVulnerabilityScanner::VerifyScanVulnerabilityCandidateArrayBuffer(verifierVulnCandidate2), true);

    data = NSVulnerabilityScanner::GetScanVulnerabilityCandidateArray(slice.data());
    EXPECT_EQ(data->candidates()->size(), 1);

    auto nvdData = data->candidates()->Get(0);

    // Verify NVD values
    EXPECT_EQ(nvdData->cveId()->str(), CVE_ID);
    EXPECT_EQ(nvdData->defaultStatus(), NSVulnerabilityScanner::Status::Status_unaffected);
    EXPECT_EQ(nvdData->platforms(), nullptr);
    EXPECT_EQ(nvdData->versions()->size(), 4);
    EXPECT_EQ(nvdData->versions()->Get(0)->status(), NSVulnerabilityScanner::Status::Status_affected);
    EXPECT_EQ(nvdData->versions()->Get(0)->version()->str(), "3.2.48");
    EXPECT_EQ(nvdData->versions()->Get(1)->status(), NSVulnerabilityScanner::Status::Status_affected);
    EXPECT_EQ(nvdData->versions()->Get(1)->version()->str(), "3.0");
    EXPECT_EQ(nvdData->versions()->Get(2)->status(), NSVulnerabilityScanner::Status::Status_affected);
    EXPECT_EQ(nvdData->versions()->Get(2)->version()->str(), "4.0");
    EXPECT_EQ(nvdData->versions()->Get(3)->status(), NSVulnerabilityScanner::Status::Status_affected);
    EXPECT_EQ(nvdData->versions()->Get(3)->version()->str(), "3.2");

    // Verify Canonical data
    EXPECT_NO_THROW(m_feedDatabase->get("bash_CVE-2010-0002", slice, "canonical"));

    flatbuffers::Verifier verifierVulnCandidate3(reinterpret_cast<const uint8_t*>(slice.data()), slice.size());
    EXPECT_EQ(NSVulnerabilityScanner::VerifyScanVulnerabilityCandidateArrayBuffer(verifierVulnCandidate3), true);

    data = NSVulnerabilityScanner::GetScanVulnerabilityCandidateArray(slice.data());
    EXPECT_EQ(data->candidates()->size(), 2);

    // Verify Canonical values
    auto canonicalData1 = data->candidates()->Get(0);
    auto canonicalData2 = data->candidates()->Get(1);

    EXPECT_EQ(canonicalData1->versions()->size(), 1);
    EXPECT_EQ(canonicalData1->versions()->Get(0)->status(), NSVulnerabilityScanner::Status::Status_affected);
    EXPECT_EQ(canonicalData1->versions()->Get(0)->version()->str(), "0");
    EXPECT_EQ(canonicalData1->versions()->Get(0)->versionType()->str(), "custom");
    EXPECT_EQ(canonicalData1->versions()->Get(0)->lessThan()->str(), "98.0.4758.102");
    EXPECT_EQ(canonicalData1->versions()->Get(0)->lessThanOrEqual(), nullptr);
    EXPECT_EQ(canonicalData1->cveId()->str(), CVE_ID);
    EXPECT_EQ(canonicalData1->defaultStatus(), NSVulnerabilityScanner::Status::Status_unknown);
    EXPECT_EQ(canonicalData1->platforms()->size(), 1);
    EXPECT_EQ(canonicalData1->platforms()->Get(0)->str(), "upstream");

    EXPECT_EQ(canonicalData2->cveId()->str(), CVE_ID);
    EXPECT_EQ(canonicalData2->defaultStatus(), NSVulnerabilityScanner::Status::Status_unaffected);
    EXPECT_EQ(canonicalData2->platforms()->size(), 6);
    EXPECT_EQ(canonicalData2->platforms()->Get(0)->str(), "dapper");
    EXPECT_EQ(canonicalData2->platforms()->Get(1)->str(), "hardy");
    EXPECT_EQ(canonicalData2->platforms()->Get(2)->str(), "intrepid");
    EXPECT_EQ(canonicalData2->platforms()->Get(3)->str(), "jaunty");
    EXPECT_EQ(canonicalData2->platforms()->Get(4)->str(), "karmic");
    EXPECT_EQ(canonicalData2->platforms()->Get(5)->str(), "lucid");
    EXPECT_EQ(canonicalData2->versions()->size(), 0);
}

TEST_F(UpdateCVECandidatesTest, RemoveCandidates)
{
    std::string cve5FlatbufferSchemaStr;

    // Read schemas from filesystem.
    bool valid = flatbuffers::LoadFile(CVE5_FLATBUFFER_SCHEMA_PATH.c_str(), false, &cve5FlatbufferSchemaStr);
    ASSERT_EQ(valid, true);

    // Parse schemas and JSON example.
    flatbuffers::Parser parser;
    valid = (parser.Parse(cve5FlatbufferSchemaStr.c_str(), INCLUDE_DIRECTORIES) && parser.Parse(CVE_INPUT_2.c_str()));
    ASSERT_EQ(valid, true);

    // Get flatbuffer pointer
    uint8_t const* buf = parser.builder_.GetBufferPointer();
    size_t flatbufferSize = parser.builder_.GetSize();

    // Verify flatbuffer.
    flatbuffers::Verifier verifierCVE5(buf, flatbufferSize);
    ASSERT_EQ(cve_v5::VerifyEntryBuffer(verifierCVE5), true);
    const cve_v5::Entry* cve5Flatbuffer = cve_v5::GetEntry(buf);

    // Call function.
    UpdateCVECandidates::storeVulnerabilityCandidate(cve5Flatbuffer, m_feedDatabase.get());

    // Verify data
    rocksdb::PinnableSlice slice;
    EXPECT_TRUE(m_feedDatabase->get("bash_CVE-2020-0002", slice, "debian"));
    EXPECT_TRUE(m_feedDatabase->get("firefox_CVE-2020-0002", slice, "debian"));
    EXPECT_TRUE(m_feedDatabase->get("bash_CVE-2020-0002", slice, "nvd"));
    EXPECT_TRUE(m_feedDatabase->get("bash_CVE-2020-0002", slice, "canonical"));
    EXPECT_TRUE(m_feedDatabase->get("kernel_CVE-2020-0002", slice, "canonical"));

    EXPECT_TRUE(
        m_feedDatabase->get("CVE-2020-0002_bash", slice, std::string(CVE_PACKAGE_COLUMN_NAME_PREFIX) + "_debian"));
    EXPECT_EQ(slice.ToString(), "bash_CVE-2020-0002");
    EXPECT_TRUE(
        m_feedDatabase->get("CVE-2020-0002_firefox", slice, std::string(CVE_PACKAGE_COLUMN_NAME_PREFIX) + "_debian"));
    EXPECT_EQ(slice.ToString(), "firefox_CVE-2020-0002");
    EXPECT_TRUE(m_feedDatabase->get("CVE-2020-0002_bash", slice, std::string(CVE_PACKAGE_COLUMN_NAME_PREFIX) + "_nvd"));
    EXPECT_EQ(slice.ToString(), "bash_CVE-2020-0002");
    EXPECT_TRUE(
        m_feedDatabase->get("CVE-2020-0002_bash", slice, std::string(CVE_PACKAGE_COLUMN_NAME_PREFIX) + "_canonical"));
    EXPECT_EQ(slice.ToString(), "bash_CVE-2020-0002");
    EXPECT_TRUE(
        m_feedDatabase->get("CVE-2020-0002_kernel", slice, std::string(CVE_PACKAGE_COLUMN_NAME_PREFIX) + "_canonical"));
    EXPECT_EQ(slice.ToString(), "kernel_CVE-2020-0002");

    // Remove candidates
    EXPECT_NO_THROW(UpdateCVECandidates::removeVulnerabilityCandidate(cve5Flatbuffer, m_feedDatabase.get()));

    // Verify data
    EXPECT_FALSE(m_feedDatabase->get("bash_CVE-2020-0002", slice, "debian"));
    EXPECT_FALSE(m_feedDatabase->get("firefox_CVE-2020-0002", slice, "debian"));
    EXPECT_FALSE(m_feedDatabase->get("bash_CVE-2020-0002", slice, "nvd"));
    EXPECT_FALSE(m_feedDatabase->get("bash_CVE-2020-0002", slice, "canonical"));
    EXPECT_FALSE(m_feedDatabase->get("kernel_CVE-2020-0002", slice, "canonical"));

    EXPECT_FALSE(
        m_feedDatabase->get("CVE-2020-0002_bash", slice, std::string(CVE_PACKAGE_COLUMN_NAME_PREFIX) + "_debian"));
    EXPECT_FALSE(
        m_feedDatabase->get("CVE-2020-0002_firefox", slice, std::string(CVE_PACKAGE_COLUMN_NAME_PREFIX) + "_debian"));
    EXPECT_FALSE(
        m_feedDatabase->get("CVE-2020-0002_bash", slice, std::string(CVE_PACKAGE_COLUMN_NAME_PREFIX) + "_nvd"));
    EXPECT_FALSE(
        m_feedDatabase->get("CVE-2020-0002_bash", slice, std::string(CVE_PACKAGE_COLUMN_NAME_PREFIX) + "_canonical"));
    EXPECT_FALSE(
        m_feedDatabase->get("CVE-2020-0002_kernel", slice, std::string(CVE_PACKAGE_COLUMN_NAME_PREFIX) + "_canonical"));
}

TEST_F(UpdateCVECandidatesTest, RemoveCandidatesSeparator)
{
    std::string cve5FlatbufferSchemaStr;

    // Read schemas from filesystem.
    bool valid = flatbuffers::LoadFile(CVE5_FLATBUFFER_SCHEMA_PATH.c_str(), false, &cve5FlatbufferSchemaStr);
    ASSERT_EQ(valid, true);

    // Parse schemas and JSON example.
    flatbuffers::Parser parser;
    valid = (parser.Parse(cve5FlatbufferSchemaStr.c_str(), INCLUDE_DIRECTORIES) && parser.Parse(CVE_INPUT_3.c_str()));
    ASSERT_EQ(valid, true);

    // Get flatbuffer pointer
    uint8_t const* buf = parser.builder_.GetBufferPointer();
    size_t flatbufferSize = parser.builder_.GetSize();

    // Verify flatbuffer.
    flatbuffers::Verifier verifierCVE5(buf, flatbufferSize);
    ASSERT_EQ(cve_v5::VerifyEntryBuffer(verifierCVE5), true);
    const cve_v5::Entry* cve5Flatbuffer = cve_v5::GetEntry(buf);

    // Call function.
    UpdateCVECandidates::storeVulnerabilityCandidate(cve5Flatbuffer, m_feedDatabase.get());

    // Parse schemas and JSON example.
    flatbuffers::Parser parser2;
    valid = (parser2.Parse(cve5FlatbufferSchemaStr.c_str(), INCLUDE_DIRECTORIES) && parser2.Parse(CVE_INPUT_4.c_str()));
    ASSERT_EQ(valid, true);

    // Get flatbuffer pointer
    buf = parser2.builder_.GetBufferPointer();
    flatbufferSize = parser2.builder_.GetSize();

    // Verify flatbuffer.
    flatbuffers::Verifier verifierCVE5_2(buf, flatbufferSize);
    ASSERT_EQ(cve_v5::VerifyEntryBuffer(verifierCVE5_2), true);
    const cve_v5::Entry* cve5Flatbuffer_2 = cve_v5::GetEntry(buf);

    // Call function.
    UpdateCVECandidates::storeVulnerabilityCandidate(cve5Flatbuffer_2, m_feedDatabase.get());

    // Verify data
    rocksdb::PinnableSlice slice;

    // Remove candidates
    EXPECT_NO_THROW(UpdateCVECandidates::removeVulnerabilityCandidate(cve5Flatbuffer, m_feedDatabase.get()));

    // Verify data
    EXPECT_FALSE(m_feedDatabase->get("windows_10_CVE-2020-1352", slice, "nvd"));
    EXPECT_FALSE(
        m_feedDatabase->get("CVE-2020-1352_windows_10", slice, std::string(CVE_PACKAGE_COLUMN_NAME_PREFIX) + "_nvd"));

    EXPECT_TRUE(m_feedDatabase->get("openusd_CVE-2020-13520", slice, "nvd"));
    EXPECT_TRUE(
        m_feedDatabase->get("CVE-2020-13520_openusd", slice, std::string(CVE_PACKAGE_COLUMN_NAME_PREFIX) + "_nvd"));
}
